CVE-2025-50099: Oracle MySQL Server InnoDB DOS Vulnerability

CVE-2025-50099 Overview

CVE-2025-50099 is a denial-of-service vulnerability in the InnoDB storage engine of Oracle MySQL Server. The flaw affects MySQL Server versions 8.0.0 through 8.0.42, 8.4.0 through 8.4.5, and 9.0.0 through 9.3.0. A high-privileged attacker with network access through multiple protocols can trigger a server hang or repeatable crash, resulting in complete loss of database availability. Oracle addressed the issue in its July 2025 Critical Patch Update. The vulnerability is classified under CWE-400: Uncontrolled Resource Consumption.

Critical Impact

Successful exploitation causes a complete denial of service against MySQL Server, hanging or crashing the database and disrupting all dependent applications.

Affected Products

• Oracle MySQL Server 8.0.0 through 8.0.42
• Oracle MySQL Server 8.4.0 through 8.4.5
• Oracle MySQL Server 9.0.0 through 9.3.0

Discovery Timeline

• 2025-07-15 - CVE-2025-50099 published to the National Vulnerability Database (NVD)
• 2025-07-15 - Oracle releases fix in the July 2025 Critical Patch Update
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-50099

Vulnerability Analysis

The vulnerability resides in the InnoDB storage engine, the default transactional engine for MySQL Server. InnoDB handles row-level locking, buffer pool management, redo logging, and multi-version concurrency control. A flaw in how InnoDB processes certain requests allows an authenticated attacker with high privileges to force the engine into an unrecoverable state. The result is either a server hang or a frequently repeatable crash, which qualifies as a complete denial of service. The issue is categorized under CWE-400: Uncontrolled Resource Consumption, indicating that attacker-controlled input can exhaust server resources or deadlock internal structures.

Root Cause

Oracle has not published root-cause details beyond the InnoDB component identification. The CWE-400 classification suggests improper limits on resource allocation, request processing, or lock handling within InnoDB. The exploit requires high privileges, meaning the attacker must already hold a valid database account with elevated rights such as administrative or schema-modification permissions.

Attack Vector

Exploitation requires network access to the MySQL Server through one of its supported protocols. The attacker authenticates with high-privileged credentials and submits a crafted request that InnoDB fails to handle safely. No user interaction is required, and the attack complexity is low. There is no impact on confidentiality or integrity; the sole impact is availability loss. Public proof-of-concept code is not available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Technical specifics of the triggering query or request have not been disclosed. Refer to the Oracle Security Alert - July 2025 for vendor guidance.

Detection Methods for CVE-2025-50099

Indicators of Compromise

• Unexpected MySQL mysqld process crashes or repeated restarts logged in the system journal or mysqld.err.
• InnoDB assertion failures, stack traces, or InnoDB: Assertion failure entries in the MySQL error log.
• Connection timeouts and client errors indicating the server has stopped responding to queries.

Detection Strategies

• Monitor MySQL error logs for repeated InnoDB-related aborts correlated with specific high-privilege sessions.
• Audit the MySQL general_log or audit_log plugin output for unusual queries issued by administrative accounts prior to crashes.
• Correlate database availability alerts with authenticated session activity to isolate the source account and client IP.

Monitoring Recommendations

• Enable the MySQL Enterprise Audit plugin or an equivalent to record all privileged statements against production databases.
• Alert on mysqld process termination events and automatic restart loops through host-based telemetry.
• Track accounts holding SUPER, SYSTEM_VARIABLES_ADMIN, or schema-level ALTER privileges and review their activity against change tickets.

How to Mitigate CVE-2025-50099

Immediate Actions Required

• Apply the Oracle July 2025 Critical Patch Update to all affected MySQL Server instances.
• Inventory database accounts with high privileges and remove unnecessary administrative rights.
• Restrict network reachability of MySQL ports to known application servers and administrative hosts.

Patch Information

Oracle released fixes for CVE-2025-50099 as part of the Oracle Critical Patch Update Advisory - July 2025. Upgrade MySQL Server to a version later than 8.0.42, 8.4.5, or 9.3.0 as listed in the advisory. Patches must be applied for each supported branch independently.

Workarounds

• Enforce least privilege and revoke administrative rights from accounts that do not require them.
• Place MySQL Server behind a firewall or security group that limits inbound connections to trusted application hosts.
• Require multi-factor authentication and bastion-host access for any session using high-privileged database accounts.

# Review accounts holding high privileges that could trigger this vulnerability
SELECT user, host FROM mysql.user
  WHERE Super_priv = 'Y' OR Create_priv = 'Y' OR Alter_priv = 'Y';

# Revoke unnecessary administrative privileges
REVOKE SUPER ON *.* FROM 'app_user'@'%';
FLUSH PRIVILEGES;